Evidence of meeting #145 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A recording is available from Parliament.
NDP
Matthew Green NDP Hamilton Centre, ON
It's not a wild assertion that you would also be doing the same practices, given that you're the subsidiary of a parent company being accused of the same thing.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
We're not sharing any Canadians' data with companies like Google or Meta at H&R Block Canada or H&R Block.
NDP
Matthew Green NDP Hamilton Centre, ON
I have a consumer question. It's related to the FTC's action that stopped H&R Block's unfair downgrading practices and deceptive promises of free filing.
Do you also offer the same type of free filing here in Canada?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
I can't speak about the specific filing products and services of H&R Block.
I can speak a bit about what we offer here at H&R Block Canada.
NDP
Matthew Green NDP Hamilton Centre, ON
Sir, I'm going to ask you the question: Are you familiar with the FTC requiring your parent company to pay $7 million to consumers?
December 12th, 2024 / 4:25 p.m.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
I am familiar with the action by the FTC.
NDP
Matthew Green NDP Hamilton Centre, ON
I'm asking you whether the product that has just resulted in a settlement there is also offered here in Canada.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
No, it is not.
NDP
Conservative
The Chair Conservative John Brassard
Okay. Thank you, Mr. Green.
That concludes the first round. We'll now go to the second round.
Mr. Chambers is going to kick it off for five minutes.
Conservative
Adam Chambers Conservative Simcoe North, ON
Thank you, Mr. Chair.
Mr. Davis, thank you for coming. I apologize for missing your earlier round. Someone played a funny trick on me this holiday season and sent the minister of the CRA at the same time to the finance committee, so that's where I was for the first few minutes.
Bring me back to the issue at hand here. Does H&R Block Canada have obligations under the federal Privacy Commissioner and the federal Privacy Act?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
Yes, with respect to the issue that the committee—
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
Yes, we do.
Conservative
Adam Chambers Conservative Simcoe North, ON
Okay.
Under that act, if there is a data breach—since H&R Block would be governed under or subject to the provisions of that act—H&R Block would be required to report on that data breach, if it was known to them, to the Privacy Commissioner. There is a reporting regime.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
That is correct, yes.
Conservative
Adam Chambers Conservative Simcoe North, ON
To my knowledge, there has not been a report from H&R Block to the Privacy Commissioner with respect to any breaches, including the ones that were in the news recently. Is that correct?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
Given that our investigation, once we were informed by CRA of the incident involving our e-file credentials.... We commenced our investigation immediately after learning about it. We went through a comprehensive investigative process, and its conclusion pointed to no evidence of any breach of our systems, software or security apparatuses at H&R Block Canada. As a result, there was no requirement or basis for us to report anything to the Privacy Commissioner.
Conservative
Adam Chambers Conservative Simcoe North, ON
I assume that, with your parent company, you not only invest a lot of resources in terms of treasure into cybersecurity and privacy breaches, but also share information about potential schemes or frauds that are perpetrated on various tax authorities, say, in Canada and the U.S. You're aware of some of the things that happen and how people's accounts get hacked. Is that correct?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
We are aware from what we see in the media sources that we monitor. In a lot of cases, it's not typical for the CRA to share that type of information with industry as of yet. Of course, there's also some information sharing between H&R Block and H&R Block Canada Inc. when it comes to cybersecurity.
Conservative
Adam Chambers Conservative Simcoe North, ON
In effect, I think I'm getting from your testimony that protecting privacy and people's personal information—their tax information but, more importantly, their private, personal information—is a core principle of what guides you as an organization. You have a lot on the line in order to protect people's personal information and their privacy in general.
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
Absolutely. We've been doing taxes in Canada for our clients for over 60 years. Data protection and the privacy of our clients' information are absolutely paramount to what we do.
Conservative
Adam Chambers Conservative Simcoe North, ON
I won't ask you to answer this, because it would potentially be unfair, but I'll say this. It is your business to keep people's information private and secure. There have been a number of other examples of outright fraud perpetrated on CRA, with a number of examples of fraud happening on the taxpayer, fraudulent schemes, and things that are not audited correctly at CRA. The absence of your reporting anything to the Privacy Commissioner tells me that this issue is likely not one that is emanating from within H&R Block, but it could be an outside source, whether that's a third party or maybe even within CRA. I'm not sure.
I won't ask you to comment, because I think that might put you in a difficult position, but when you have CRA saying “It's not us” and you have a list of examples in the past where they've had some challenges with fraud and protecting private information, that makes sense to me. I think your testimony is genuine, and I hope that, to the extent that you find any information, you will bring it forward.
Can you follow up? You mentioned the CRA not collaborating as much with industry, but that does happen in the U.S. Is that correct?
Associate Vice-President, Government and Stakeholder Relations, H&R Block Canada Inc.
My understanding is that there are mechanisms for collaboration between the IRS and the tax preparation industry in the United States—namely, the security summit. We don't have a similar mechanism here in Canada, and that is something that would be beneficial for CRA to consider.
Conservative
Adam Chambers Conservative Simcoe North, ON
Thank you for that testimony, Mr. Davis, and congratulations on 60 years in business.